Align Enterprise-Managed Authorization with id-jag-04 and promote to stable by pcarleton · Pull Request #29 · modelcontextprotocol/ext-auth · GitHub

Two changes to the Enterprise-Managed Authorization extension:

1. Reduce duplication against id-jag-04

References draft-ietf-oauth-identity-assertion-authz-grant-04 directly for roles, token exchange parameters, ID-JAG claims, and processing rules, keeping only MCP-specific constraints inline.

Adopt Resource Authorization Server / IdP Authorization Server terminology from id-jag §2
Replace parameter and claim tables with section references plus MCP-specific deltas
Keep resource REQUIRED in this profile (id-jag-04 made it optional)
Drop the restriction on actor_token (removed upstream in -03)
Replace multi-tenant implementation notes with a reference to id-jag §6
Reference id-jag §5 for cross-domain client_id handling
Add a Discovery section referencing authorization_grant_profiles_supported (id-jag §7.2)
Require the issued access token to be audience-restricted to the resource claim in the ID-JAG

2. Promote to specification/stable/

Moves the document from draft/ to a new stable/ directory to indicate it is ready for use and has reference implementations. README updated to list Stable and Draft extensions separately; in-document status banner updated to match.

Examples and the sequence diagram are unchanged.

Reduce duplication by referencing draft-ietf-oauth-identity-assertion-authz-grant-04 for roles, token exchange parameters, ID-JAG claims, and processing rules, keeping only MCP-specific constraints inline. - Adopt 'Resource Authorization Server' terminology from id-jag §2 - Replace parameter/claim tables with section references plus MCP deltas - Keep `resource` REQUIRED in this profile (id-jag-04 made it optional) - Drop the restriction on `actor_token` (removed upstream in -03) - Replace multi-tenant implementation notes with reference to id-jag §6 - Reference id-jag §5 for cross-domain client_id handling - Add Discovery section referencing `authorization_grant_profiles_supported`

Move the extension from specification/draft/ to specification/stable/ to indicate it is ready for use and has reference implementations. Update the README to list stable and draft extensions separately, and update the in-document status banner to match.

Co-authored-by: Aaron Parecki <aaron@parecki.com>

pcarleton added 2 commits June 17, 2026 19:52

pcarleton changed the title Align Enterprise-Managed Authorization with id-jag-04 Align Enterprise-Managed Authorization with id-jag-04 and promote to stable Jun 17, 2026

pcarleton marked this pull request as ready for review June 17, 2026 19:15

pcarleton requested a review from aaronpk June 17, 2026 19:15